Bug 531526

Summary:	<net-misc/openvpn-2.3.6 Denial of Service Vulnerability CVE-2014-8104
Product:	Gentoo Security	Reporter:	Daniel "Fremen" Llewellyn <diddledan>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Daniel "Fremen" Llewellyn 2014-12-03 11:48:50 UTC

OpenVPN upstream released version 2.3.6 on December 1st. It appears this version is already in the portage tree, yet there hasn't been an appropriate GLSA raised for CVE-2014-8104 which this release fixes. The vulnerable code has been in all openvpn 2.x since 2005 and potentially before that. I feel that a GLSA should be raised for <net-misc/openvpn-2.3.6 to encourage all installations to update to the fixed version.

Ref: https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b

Comment 1 Jeroen Roovers (RETIRED) gentoo-dev

2014-12-03 12:43:25 UTC


*** This bug has been marked as a duplicate of bug 531308 ***